@genesislcap/ai-assistant 15.7.0 → 15.7.2

package/dist/dts/utils/banked-usage-baselines.d.ts

@@ -0,0 +1,51 @@
+import type { AggregateUsage } from '@genesislcap/foundation-ai';
+/**
+ * The baseline resolved for `key`, or `undefined` when this session has not resolved one yet.
+ *
+ * `undefined` rather than an empty usage: "nothing banked" is a legitimate resolved value (a
+ * project's first ever session), and it must not be mistaken for "not resolved", or every write
+ * would re-derive and hit the double-count above.
+ *
+ * Returns a copy — see `setBankedBaseline` for why both ends of this map are cloned.
+ *
+ * @internal
+ */
+export declare function getBankedBaseline(key: string): AggregateUsage | undefined;
+/**
+ * Record the baseline for `key`, replacing any previous one.
+ *
+ * Stores a copy, and `getBankedBaseline` hands back a copy, so nothing outside this module can
+ * reach the object the map holds. Both ends have to clone, because a baseline is aliased at both:
+ * `resolveBankedUsage` returns a *reference into a ledger row* (`row.banked` or `row.usage`),
+ * which is what gets stored here, and the caller then assigns what it reads back onto the NEXT
+ * row's `banked` field. Uncloned, one object is reachable from page-global state, two rows, and —
+ * since the row list is public and gets handed to a host's `saveCostHistory` — from host code.
+ * Whoever mutated it would silently rewrite this project's baseline for the rest of the page.
+ *
+ * A shallow spread is a complete copy: `AggregateUsage` is five flat numbers, no nested state.
+ *
+ * @internal
+ */
+export declare function setBankedBaseline(key: string, usage: AggregateUsage): void;
+/**
+ * Drop the baseline for `key`, so the next write re-derives it from the ledger rows.
+ *
+ * For when the pairing is broken deliberately at the *row* end — the row this baseline came from
+ * has been deleted, or the whole ledger cleared — and for a session teardown, where the store
+ * (and with it the transcript) is disposed and a later return re-restores from scratch.
+ *
+ * NOT for a mid-session reload of the rows: those rows already include this session's own
+ * upserts, so re-deriving from them folds the live transcript into its own baseline.
+ *
+ * @internal
+ */
+export declare function deleteBankedBaseline(key: string): void;
+/**
+ * Forget every baseline — the page-load boundary, which production gets for free from module
+ * state dying with the realm. Exists so tests can model separate page loads (and so one test's
+ * session key cannot leak a baseline into the next).
+ *
+ * @internal
+ */
+export declare function resetBankedBaselines(): void;
+//# sourceMappingURL=banked-usage-baselines.d.ts.map

package/dist/dts/utils/banked-usage-baselines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banked-usage-baselines.d.ts","sourceRoot":"","sources":["../../../src/utils/banked-usage-baselines.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA6BjE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAGzE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAE1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/esm/components/settings-modal/settings-modal.styles.js

@@ -304,9 +304,9 @@ export const settingsModalStyles = css `
   }
 
   /*
-   * Deliberately quieter than the live block: no pulsing badge and no accent, so the
-   * eye still lands on what is being built now. It leads only because it is the wider
-   * figure, not because it is the more urgent one.
+   * Deliberately quieter than the live block: no pulsing badge and no accent, so the eye lands
+   * on what is being built now — which is why that block leads the tab and this one follows,
+   * under the history heading whose rows it totals.
    */
   .settings-lifetime-usage-top {
     display: flex;
@@ -489,7 +489,14 @@ export const settingsModalStyles = css `
 
   .settings-token-bucket {
     display: flex;
-    min-width: 0;
+
+    /*
+     * min-content (not 0) so a bucket cannot be shrunk narrower than its own unbreakable label.
+     * With the label set to nowrap, a zero minimum would overflow it into the next column instead
+     * of wrapping — so the container's flex-wrap takes over and moves a bucket to a second row,
+     * which is the degradation we want when the modal is dragged narrow.
+     */
+    min-width: min-content;
     flex-direction: column;
     gap: 2px;
   }
@@ -500,6 +507,15 @@ export const settingsModalStyles = css `
     text-transform: uppercase;
     letter-spacing: 0.06em;
     color: var(--neutral-foreground-hint);
+
+    /*
+     * One line, always. The rate marker is a separate inline box after collapsible whitespace, so
+     * a wrappable label gives it a break opportunity of its own — in a narrow column it orphaned
+     * onto line 2, which also pushed that bucket's value a line below the other three and broke
+     * the row of figures. nowrap removes every break opportunity in the label, the space before
+     * the marker included, so no glue character is needed.
+     */
+    white-space: nowrap;
   }
 
   .settings-token-bucket-value {
@@ -509,13 +525,24 @@ export const settingsModalStyles = css `
   }
 
   /*
-   * Cache reads bill at a fraction of the uncached input rate, and in an agentic
-   * session they are usually the largest bucket by a wide margin. Muted so the biggest
-   * number on the row doesn't read as the dominant cost driver when it is the cheapest.
+   * The price-direction marker on a cache bucket's label — down for reads (a fraction of the
+   * uncached input rate), up for writes (a premium over it). Three tiers, so a bucket with no
+   * marker is the reference rate rather than an unlabelled fourth case.
+   *
+   * Carried by the label rather than the value, which is what this used to do: cache reads are
+   * usually the largest bucket by a wide margin in an agentic session, so the value was muted to
+   * stop the biggest number reading as the dominant cost driver. That priced the treatment to the
+   * wrong thing — a dimmed 0 (every Gemini cache write) looked disabled next to a normal 0, and a
+   * rate is a property of the bucket, not of this turn's figure.
+   *
+   * Sized down and nudged up rather than tinted: the label is already the hint colour, so a
+   * dimmer marker would vanish and a brighter one would out-shout the word it qualifies.
    */
-  .settings-token-bucket.is-discounted .settings-token-bucket-value {
-    font-weight: 500;
-    color: var(--neutral-foreground-hint);
+  .settings-token-bucket-rate {
+    font-size: 8px;
+    line-height: 1;
+    vertical-align: 0.15em;
+    letter-spacing: 0;
   }
 
   /*
@@ -537,9 +564,15 @@ export const settingsModalStyles = css `
     margin-bottom: 0;
   }
 
-  /* Equal columns, so the four buckets line up as a grid rather than bunching left. */
+  /*
+   * Basis auto, not 0: a zero basis splits the row into four equal columns, so CACHE WRITE is
+   * squeezed exactly as hard as INPUT despite being twice the label. Sizing from content gives the
+   * long labels the room their text needs and lets the short ones concede it, which is what makes
+   * white-space: nowrap above safe — every column starts at least as wide as its own content,
+   * then shares the slack. Still grows and shrinks, so the four stay flush edge to edge.
+   */
   .settings-usage-row .settings-token-bucket {
-    flex: 1 1 0;
+    flex: 1 1 auto;
   }
 
   .settings-model-tags {
@@ -579,6 +612,16 @@ export const settingsModalStyles = css `
     margin: calc(var(--design-unit) * 4px) 0 calc(var(--design-unit) * 2px);
   }
 
+  /*
+   * The heading labels the lifetime card as well as the rows, so the card gives up its own top
+   * margin and the gap becomes the heading's alone. Adjacent siblings collapse to the LARGER of
+   * the two margins, so leaving both would space the caps 3 units off the block they label while
+   * the rows below sit at 2 — reading as though the heading belonged to neither.
+   */
+  .settings-cost-history-title + .settings-lifetime-usage {
+    margin-top: 0;
+  }
+
   .settings-cost-history {
     display: flex;
     flex-direction: column;
@@ -615,14 +658,16 @@ export const settingsModalStyles = css `
   }
 
   /*
-   * Both of these carry a ?hidden binding (showTokens), and both declare display: flex — which
-   * silently beat the UA [hidden] { display: none } rule, because author-origin declarations
-   * outrank user-agent origin whatever the specificity. Without this, showTokens: false still
-   * rendered the full breakdown in the lifetime block, the live block and every history row.
-   * Sibling elements that hide correctly do so only by declaring no display at all. Same
-   * treatment as .settings-modal-tab-panel[hidden] near the top of this file.
+   * All of these carry a ?hidden binding, and all declare display: flex — which silently beat the
+   * UA [hidden] { display: none } rule, because author-origin declarations outrank user-agent
+   * origin whatever the specificity. Without this, showTokens: false still rendered the full
+   * breakdown in the lifetime block, the live block and every history row, and an empty row list
+   * still occupied its padding under the lifetime total. Sibling elements that hide correctly do
+   * so only by declaring no display at all. Same treatment as .settings-modal-tab-panel[hidden]
+   * near the top of this file.
    */
   .settings-usage-row-tokens[hidden],
+  .settings-cost-history[hidden],
   .settings-cost-history-row-content[hidden] {
     display: none !important;
   }

package/dist/esm/components/settings-modal/settings-modal.template.js

@@ -204,6 +204,12 @@ const modelTagTemplate = html `
  * this puts output between the three buckets that partition the prompt, so their relationship is
  * carried by the tooltips rather than by adjacency.
  *
+ * The two cache buckets carry a direction marker on their LABEL, not their value: below the input
+ * rate for reads, above it for writes. On the label because the rate is a fixed property of the
+ * bucket, whereas the value changes every turn — and because styling the values instead means a
+ * bucket reading 0 (every Gemini cache write, which has no write bucket to bill) renders in a
+ * dimmed treatment that looks disabled beside a normal 0. All four values stay identical.
+ *
  * `partPrefix` keeps the shadow-part names caller-specific (`session-tokens-input`,
  * `lifetime-tokens-input`, …) so a host can style one context without hitting the others.
  */
@@ -240,12 +246,17 @@ const tokenBreakdownTemplate = (usageOf, partPrefix) => html `
           :innerHTML="${(x) => formatCompactTokenCountSafe(usageOf(x).outputTokens)}"
         ></span>
       </div>
-      <div class="settings-token-bucket is-discounted" part="${partPrefix}-tokens-cache-read">
+      <div class="settings-token-bucket" part="${partPrefix}-tokens-cache-read">
         <span
           class="settings-token-bucket-label"
           title="Prompt tokens served from the provider cache — billed at a fraction of the uncached rate"
         >
           Cache read
+          <!--
+            aria-hidden: the marker is a restatement of the tooltip this label already carries, and
+            a screen reader announcing "black down-pointing small triangle" mid-heading is noise.
+          -->
+          <span class="settings-token-bucket-rate" aria-hidden="true">▾</span>
         </span>
         <span
           class="settings-token-bucket-value"
@@ -258,6 +269,7 @@ const tokenBreakdownTemplate = (usageOf, partPrefix) => html `
           title="Prompt tokens written to the provider cache — billed at a premium over the uncached rate"
         >
           Cache write
+          <span class="settings-token-bucket-rate" aria-hidden="true">▴</span>
         </span>
         <span
           class="settings-token-bucket-value"
@@ -270,9 +282,14 @@ const tokenBreakdownTemplate = (usageOf, partPrefix) => html `
 /**
  * Lifetime usage across every project in the history scope.
  *
- * Sits above the live session block because it is the wider figure. It used to live inside
- * that block as a lone "Total build cost", where the live badge and project name directly
- * above it implied the total belonged to the open project.
+ * Sits under the "Build history" heading, above the rows it totals — the live block leads the tab
+ * instead, because the project open now is what a user came to check. Being inside the history
+ * grouping is also what identifies this figure: it is the sum of the rows below it, not a rival
+ * reading of the block above it.
+ *
+ * It must not sit inside the live block, which is where it began life as a lone "Total build
+ * cost": the live badge and project name directly above it implied the total belonged to the open
+ * project.
  */
 const lifetimeUsageTemplate = () => html `
     ${when((x) => x.settingsCostLifetimeVisible, html `
@@ -509,7 +526,6 @@ export const SettingsModalTemplate = (designSystemPrefix) => {
       part="cost-tab-panel"
     >
       <div class="settings-modal-body" part="settings-modal-body">
-      ${lifetimeUsageTemplate()}
       ${sessionCostSummaryTemplate()}
       <div
         class="settings-cost-current"
@@ -518,9 +534,15 @@ export const SettingsModalTemplate = (designSystemPrefix) => {
       >
         <slot name="settings-cost-current" ${slotted('settingsCostCurrentSlotted')}></slot>
       </div>
-      <p class="settings-cost-history-title" ?hidden=${(x) => !x.settingsCostHistorySectionVisible}>
+      <!--
+        The heading covers everything below it, lifetime total included — that total IS the sum of
+        the history rows, so it reads as their summary rather than a rival figure. Hence the
+        heading's own visibility gate, which is broader than the rows'.
+      -->
+      <p class="settings-cost-history-title" ?hidden=${(x) => !x.settingsCostHistoryHeadingVisible}>
         Build history
       </p>
+      ${lifetimeUsageTemplate()}
       <div
         class="settings-cost-history"
         part="settings-cost-history"
@@ -574,7 +596,14 @@ export const SettingsModalTemplate = (designSystemPrefix) => {
                 ${when((x) => !!x.resolvedCostHistory.summaryHint, html `
                     ${(x) => x.resolvedCostHistory.summaryHint}
                   `)}Costs
-                are estimated from token usage at list price.
+                are estimated from token usage at list
+                price.${when(
+    // Only where the markers actually render. Every place they appear is gated on
+    // showTokens, so with cost figures but no token buckets this sentence would
+    // define two glyphs that are nowhere on screen.
+    (x) => x.resolvedCostHistory.showTokens, html `
+                    Cache reads bill below the input rate (▾) and cache writes above it (▴).
+                  `)}
               </span>
             `)}
           <${buttonTag}

package/dist/esm/main/cost-session-banking.test.js

@@ -1,4 +1,5 @@
 import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { getBankedBaseline, resetBankedBaselines, setBankedBaseline, } from '../utils/banked-usage-baselines';
 import { clearCostSessionHistory, loadCostSessionHistory, } from '../utils/cost-session-history';
 import { emptyUsage } from '../utils/sum-usage';
 import { FoundationAiAssistant } from './main';
@@ -28,9 +29,17 @@ const usage = (costUsd, outputTokens = 100) => (Object.assign(Object.assign({},
 /**
  * An unconnected element with just enough session state wired for `finalizeCostSession`:
  * the live usage it projects, the transcript it titles from, and the key it upserts against.
+ *
+ * Banked baselines are module state keyed by session (so remounts share one), which means they
+ * outlive an element. Cleared by default, because every suite but the remount ones is modelling
+ * a *fresh page load* — and because leaving them would leak one suite's baseline into the next
+ * under the shared `PROJECT` key. Pass `remount: true` to model a new element joining a session
+ * that has already banked, which is the case this file exists to pin.
  */
 function element(options) {
     var _a, _b, _c;
+    if (!options.remount)
+        resetBankedBaselines();
     const el = document.createElement('foundation-ai-assistant');
     const messages = [{ role: 'user', content: 'build me a blotter' }];
     const internals = el;
@@ -267,10 +276,10 @@ Suite('an unreadable ledger blocks writes instead of replacing it with what we c
     clearCostSessionHistory(scope);
 });
 Suite('deleting a provider row whose id differs from its projectKey still drops the memo', () => {
-    // `_bankedFor` holds a projectKey; the delete action passes a row id. A host provider can assign
-    // any id, so comparing across the two namespaces skipped the reset and the next turn resurrected
-    // the deleted total. Reachable when a provider load lands AFTER a finalize has banked: our own
-    // upsert would otherwise have rewritten the row's id to the projectKey.
+    // Baselines are keyed by projectKey; the delete action passes a row id. A host provider can
+    // assign any id, so deleting by the wrong namespace left the baseline in place and the next
+    // turn resurrected the deleted total. Reachable when a provider load lands AFTER a finalize has
+    // banked: our own upsert would otherwise have rewritten the row's id to the projectKey.
     const scope = 'ledger-remove-id';
     clearCostSessionHistory(scope);
     const el = element({
@@ -279,16 +288,221 @@ Suite('deleting a provider row whose id differs from its projectKey still drops
         rows: [row({ id: 'host-assigned-uuid', projectKey: PROJECT, usage: usage(10) })],
         persistenceActive: false,
     });
-    // Memo already populated for this project, as it would be after a turn.
-    const internals = el;
-    internals._bankedFor = PROJECT;
-    internals._bankedUsage = usage(10);
+    // Baseline already resolved for this project, as it would be after a turn — set directly
+    // rather than by finalizing, because our own upsert would rewrite the row's id to the
+    // projectKey and the id mismatch under test would vanish with it.
+    setBankedBaseline(PROJECT, usage(10));
     el.removeCostSessionFromHistory('host-assigned-uuid');
     assert.is(el.costSessionHistory.length, 0);
     el.finalizeCostSession();
     assert.is(el.costSessionHistory[0].usage.costUsd, 2, 'deleted total must not come back');
     clearCostSessionHistory(scope);
 });
+Suite('a remount mid-session does not re-bank what the row already holds', () => {
+    var _a;
+    // The reported regression (GENC-1475). Reproduces the field report exactly: with persistence
+    // off, the host remounted the assistant part-way through a session (a layout re-render — the
+    // debug log showed seven connects in one session) and the LIFETIME figure jumped by the whole
+    // session-to-date while the live figure kept climbing normally.
+    //
+    // The new element joins a live session: same key, same transcript, and rows that already
+    // contain the previous instance's upsert. An element-scoped baseline re-derived here and, with
+    // no restore to defer to, banked `row.usage` — which already included this very transcript.
+    const scope = 'bank-remount';
+    clearCostSessionHistory(scope);
+    const first = element({
+        scope,
+        live: usage(6),
+        rows: [row({ usage: usage(1), banked: usage(1) })],
+        persistenceActive: false,
+    });
+    first.finalizeCostSession();
+    assert.is(first.costSessionHistory[0].usage.costUsd, 7, '1 banked + 6 live');
+    // Remount: a brand new element wired to the same session, handed the rows as they now stand.
+    const second = element({
+        scope,
+        live: usage(6),
+        rows: first.costSessionHistory,
+        persistenceActive: false,
+        remount: true,
+    });
+    second.finalizeCostSession();
+    assert.is(second.costSessionHistory[0].usage.costUsd, 7, 'remount must not inflate the row');
+    assert.is((_a = second.costSessionHistory[0].banked) === null || _a === void 0 ? void 0 : _a.costUsd, 1, 'baseline unchanged by the remount');
+    // And the session keeps accruing normally afterwards, on top of the SAME baseline.
+    const third = element({
+        scope,
+        live: usage(9),
+        rows: second.costSessionHistory,
+        persistenceActive: false,
+        remount: true,
+    });
+    third.finalizeCostSession();
+    assert.is(third.costSessionHistory[0].usage.costUsd, 10, '1 banked + 9 live');
+    clearCostSessionHistory(scope);
+});
+Suite('a page reload still absorbs the prior total after a remount banked nothing new', () => {
+    // The other half of the pairing: dropping the baseline on remount is wrong, but keeping it
+    // across a *page load* would be too — the transcript starts empty there (persistence off), so
+    // the row's whole total must be banked. `resetBankedBaselines` stands in for the realm dying.
+    const scope = 'bank-reload';
+    clearCostSessionHistory(scope);
+    const before = element({
+        scope,
+        live: usage(6),
+        rows: [row({ usage: usage(1), banked: usage(1) })],
+        persistenceActive: false,
+    });
+    before.finalizeCostSession();
+    assert.is(before.costSessionHistory[0].usage.costUsd, 7);
+    const afterReload = element({
+        scope,
+        live: usage(2),
+        rows: before.costSessionHistory,
+        persistenceActive: false,
+    });
+    afterReload.finalizeCostSession();
+    assert.is(afterReload.costSessionHistory[0].usage.costUsd, 9, 'prior 7 banked, this load adds 2');
+    clearCostSessionHistory(scope);
+});
+Suite('clearing the transcript re-baselines instead of discarding spend', () => {
+    var _a;
+    // Clear empties the transcript, so the row's total now predates what is on screen and has to be
+    // banked wholesale. Merely dropping the baseline would re-derive through `persistenceActive`,
+    // which with persistence ON carries the row's OLD banked figure forward and silently loses
+    // every turn between that baseline and the clear.
+    const scope = 'bank-clear-session';
+    clearCostSessionHistory(scope);
+    const el = element({
+        scope,
+        live: usage(6),
+        rows: [row({ usage: usage(10), banked: usage(4) })],
+        persistenceActive: true,
+    });
+    el.finalizeCostSession();
+    assert.is(el.costSessionHistory[0].usage.costUsd, 10);
+    // `clearSession` itself tears down and rebuilds the driver, which an unconnected element has
+    // none of — so drive the one step under test. `clearSession` reads the live figure before
+    // `resetSession` zeroes it and passes it in; the 6 here is that capture.
+    const priv = el;
+    priv.rebaselineOnClearedTranscript(PROJECT, usage(6));
+    // A fresh transcript worth 3, on top of the whole 10 the project had accrued.
+    priv._sessionRef.store.aiAssistant.sessionUsage = usage(3);
+    el.finalizeCostSession();
+    assert.is(el.costSessionHistory[0].usage.costUsd, 13, 'pre-clear spend kept, new turn added');
+    assert.is((_a = el.costSessionHistory[0].banked) === null || _a === void 0 ? void 0 : _a.costUsd, 10, 'whole pre-clear total banked');
+    clearCostSessionHistory(scope);
+});
+Suite('clearing while the ledger is still loading must not pin a baseline', () => {
+    var _a;
+    // Review case. A stamped baseline is sticky — `bankedUsageFor` short-circuits on any stored
+    // entry and a zero usage is a *resolved* value there. On the provider path the row list is empty
+    // and `_costHistoryLoaded` false while the read is in flight, so a clear landing in that window
+    // used to pin a baseline derived from no rows at all. The load arriving afterwards with the
+    // project's real total was then never consulted, and the next write replaced its row with
+    // `banked: 0` — the project's whole history gone.
+    const scope = 'bank-clear-unloaded';
+    clearCostSessionHistory(scope);
+    const el = element({ scope, live: usage(5), loaded: false });
+    const priv = el;
+    // Clear arrives before the provider read lands: rows are empty and nothing is known yet.
+    priv.rebaselineOnClearedTranscript(PROJECT, usage(5));
+    assert.is(getBankedBaseline(PROJECT), undefined, 'nothing pinned from a ledger we cannot see');
+    // The read lands with this project's real history, and a turn follows.
+    el.costSessionHistory = [row({ usage: usage(42), banked: usage(40) })];
+    priv._costHistoryLoaded = true;
+    priv._sessionRef.store.aiAssistant.sessionUsage = usage(1);
+    el.finalizeCostSession();
+    assert.is(el.costSessionHistory[0].usage.costUsd, 43, "the project's 42 survives the race");
+    assert.is((_a = el.costSessionHistory[0].banked) === null || _a === void 0 ? void 0 : _a.costUsd, 42, 'baseline re-derived from real rows');
+    clearCostSessionHistory(scope);
+});
+Suite('clearing banks a transcript the row has not caught up with', () => {
+    var _a;
+    // Review case: without this, the suite passed identically against the OLD derivation
+    // (`existing?.usage`), because everywhere else the row already agreed with baseline + live.
+    //
+    // The formulas only diverge when the row is STALE relative to the transcript — which is exactly
+    // what the new one exists for, since `finalizeCostSession` skips its write while the ledger is
+    // unloaded and while the session has no usage. No finalize here, so the row lags by 3.
+    const scope = 'bank-clear-stale-row';
+    clearCostSessionHistory(scope);
+    const el = element({
+        scope,
+        live: usage(3),
+        rows: [row({ usage: usage(42), banked: usage(40) })],
+        persistenceActive: false,
+    });
+    const priv = el;
+    priv.rebaselineOnClearedTranscript(PROJECT, usage(3));
+    // 42 from the row plus the 3 the discarded transcript proved. The old row-read banked 42 flat.
+    assert.is((_a = getBankedBaseline(PROJECT)) === null || _a === void 0 ? void 0 : _a.costUsd, 45, 'the stale 3 is banked, not dropped');
+    priv._sessionRef.store.aiAssistant.sessionUsage = usage(1);
+    el.finalizeCostSession();
+    assert.is(el.costSessionHistory[0].usage.costUsd, 46, '45 banked + the new turn');
+    clearCostSessionHistory(scope);
+});
+Suite('a memoised baseline survives a clear during a reload instead of being dropped', () => {
+    var _a, _b;
+    // Review case. The guard is broader than the derivation needs: once a baseline is memoised the
+    // new figure is determined without any rows, so deleting it there throws away something correct.
+    // Concretely — row at usage 120 / banked 90, baseline memoised at 90, 30 on screen — dropping it
+    // made the next turn re-derive `row.banked` and rewrite the row BACKWARDS from 120 to 95.
+    const scope = 'bank-clear-memoised';
+    clearCostSessionHistory(scope);
+    const el = element({
+        scope,
+        live: usage(30),
+        rows: [row({ usage: usage(120), banked: usage(90) })],
+        persistenceActive: true,
+    });
+    el.finalizeCostSession();
+    assert.is((_a = getBankedBaseline(PROJECT)) === null || _a === void 0 ? void 0 : _a.costUsd, 90, 'baseline memoised off the restored row');
+    // A chatConfig rebind puts the ledger back in flight, and the clear lands inside that window.
+    const priv = el;
+    priv._costHistoryLoaded = false;
+    priv.rebaselineOnClearedTranscript(PROJECT, usage(30));
+    assert.is((_b = getBankedBaseline(PROJECT)) === null || _b === void 0 ? void 0 : _b.costUsd, 120, '90 kept and the discarded 30 added');
+    priv._costHistoryLoaded = true;
+    priv._sessionRef.store.aiAssistant.sessionUsage = usage(5);
+    el.finalizeCostSession();
+    assert.is(el.costSessionHistory[0].usage.costUsd, 125, 'row moves forward, never backwards');
+    clearCostSessionHistory(scope);
+});
+Suite('clearing with the ledger disabled pins nothing, even though it reads as loaded', () => {
+    // Review case. `reloadCostSessionHistory` sets `_costHistoryLoaded` TRUE over a deliberately
+    // empty list when `enabled` is false — "nothing will be loaded", not "rows are known" — so the
+    // flag alone let a clear pin a baseline from a ledger that was never read. A host enabling
+    // history afterwards (an async setting, a feature flag) then had its real row buried by it.
+    const scope = 'bank-clear-disabled';
+    clearCostSessionHistory(scope);
+    const el = element({ scope, live: usage(3) });
+    el.chatConfig = { costHistory: { enabled: false, scope } };
+    const priv = el;
+    assert.is(priv._costHistoryLoaded, true, 'reads as loaded despite nothing being known');
+    priv.rebaselineOnClearedTranscript(PROJECT, usage(3));
+    assert.is(getBankedBaseline(PROJECT), undefined, 'nothing pinned while the ledger is off');
+    // History switched on afterwards, and this project turns out to have real spend.
+    el.chatConfig = { costHistory: { enabled: true, scope, title: 'Trade Blotter' } };
+    el.costSessionHistory = [row({ usage: usage(50), banked: usage(50) })];
+    priv._costHistoryLoaded = true;
+    priv._sessionRef.store.aiAssistant.sessionUsage = usage(1);
+    el.finalizeCostSession();
+    assert.is(el.costSessionHistory[0].usage.costUsd, 51, "the project's 50 is not buried");
+    clearCostSessionHistory(scope);
+});
+Suite('a host slotting its own build history does not have to enable our ledger', () => {
+    // Review case. `enabled` governs the BUILT-IN ledger and defaults false, while the Usage tab
+    // shows for showCost/showTokens which default true. Once the section's ?hidden binding became
+    // effective, short-circuiting on `enabled` above the slot check hid a host's own markup — and
+    // the slot is the only thing in that container.
+    const el = element({ scope: 'slotted-history', live: usage(1) });
+    el.chatConfig = { costHistory: { enabled: false } };
+    assert.is(el.settingsCostHistorySectionVisible, false, 'nothing slotted, ledger off → hidden');
+    el.settingsCostHistorySlotted = [document.createElement('div')];
+    assert.is(el.settingsCostHistorySectionVisible, true, 'slotted content shows without `enabled`');
+    assert.is(el.settingsCostHistoryHeadingVisible, true, 'and the heading comes with it');
+});
 Suite('hides the lifetime section when no state key at all can produce a row', () => {
     const el = element({ scope: 'ledger-nokey', live: usage(3) });
     assert.is(el.settingsCostLifetimeVisible, true, 'visible with a key');
@@ -305,4 +519,20 @@ Suite('labels the live figures by whether the transcript is authoritative', () =
     const without = element({ scope: 'bank-label', live: usage(1), persistenceActive: false });
     assert.is(without.liveUsageIsProjectLifetime, false, 'not restored → this session only');
 });
+Suite('a stored baseline is isolated from the row and the caller it passed through', () => {
+    var _a, _b;
+    // A baseline arrives as a reference into a ledger row (`resolveBankedUsage` returns `row.banked`
+    // or `row.usage`) and is read back onto the NEXT row's `banked` field, so an uncloned map entry
+    // is reachable from page-global state, two rows, and any host handed the row list. Mutating
+    // either end must not move the stored figure, or a project's baseline is silently rewritten for
+    // the rest of the page.
+    resetBankedBaselines();
+    const source = usage(10);
+    setBankedBaseline(PROJECT, source);
+    source.costUsd = 999;
+    assert.is((_a = getBankedBaseline(PROJECT)) === null || _a === void 0 ? void 0 : _a.costUsd, 10, 'mutating the source cannot reach the map');
+    const readBack = getBankedBaseline(PROJECT);
+    readBack.costUsd = 777;
+    assert.is((_b = getBankedBaseline(PROJECT)) === null || _b === void 0 ? void 0 : _b.costUsd, 10, 'mutating a read copy cannot reach the map');
+});
 Suite.run();